Network attacks are becoming increasingly sophisticated and malicious, and the risk of data breaches and their consequences grows. Failure to thwart attacks can damage a business's reputation and result in loss of revenue. In addition, governments and other authoritative bodies are taking on a more active role in protecting individual's sensitive electronic information. For example, in the United States and abroad, statutes and standards such as the Health Insurance Portability and Accountability Act (HIPAA), Sarbanes Oxley (SOX), and the Payment Card Industry Data Security Standard (PCI DSS) have been put in place for enterprises to take appropriate steps to ensure the proper use and protection of both corporate and personal communications and information. These regulations and standards are often backed by financial penalties for public or private organizations that fail to comply or where personal data is actually breached.
Compliance can be a state of comporting with governmental regulations, industry standards, and similar guidelines, or the process toward this state. Conventional approaches for compliance may be inadequate to the challenges facing networks today. Many solutions tend to focus on the network edge (i.e., north-south traffic). Thus, networks using these solutions may be especially vulnerable to attacks occurring within the network (i.e., east-west traffic) and are likely to be non-compliant. Conventional techniques are also typically reactive and cannot resolve security breaches in real time or substantially real time. In addition, conventional networks often fail to gather all relevant information for preventing, diagnosing, and remedying malicious network activity.